mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-10-30 22:21:58 +01:00
ARUNAVO RAY
e02856180a
- Raise the zod floor to 4.6.7 (GHSA-mrhx-c7xc-m3w5). Astro's nested 4.5.4 resolves to the same copy and an override keeps both there. No other package in bun.lock changes. - Add .github/dependabot.yml: bun for the root, npm for www, open-pull-requests-limit 0 so only security updates open pull requests.
21 lines
663 B
YAML
21 lines
663 B
YAML
# Dependabot reads this for security updates as well as version updates.
|
|
# Without it, security updates for the root ran the npm ecosystem, which
|
|
# cannot update bun.lock, and every security update job failed.
|
|
#
|
|
# open-pull-requests-limit: 0 turns off version update pull requests and
|
|
# leaves security updates on, which is how the repository ran before.
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: "bun"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 0
|
|
|
|
# The documentation site, locked with pnpm.
|
|
- package-ecosystem: "npm"
|
|
directory: "/www"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 0
|